hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix method name in LocalDatabaseOpenMethodAccess

Browse Source
This commit is contained in:
Tony Torralba
2022-01-20 14:10:02 +01:00
parent 652a1d2dc2
commit 4f253590f1
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll
View File

@@ -33,7 +33,7 @@ class LocalDatabaseOpenMethodAccess extends Storable, Call {
m.hasName("getWritableDatabase")
or
m.getDeclaringType() instanceof TypeSQLiteDatabase and
m.hasName(["create", "open%Database", "compileStatement"])
m.hasName(["create", "openDatabase", "openOrCreateDatabase", "compileStatement"])
or
m.getDeclaringType().getASupertype*() instanceof TypeContext and
m.hasName("openOrCreateDatabase")

10
java/ql/test/query-tests/security/CWE-312/CleartextStorageAndroidDatabaseTest.java
View File

@@ -19,14 +19,20 @@ public class CleartextStorageAndroidDatabaseTest extends Activity {
db.execSQL("DROP TABLE passwords;"); // Safe - no sensitive value being stored
}
public void testCleartextStorageAndroiDatabase1(Context ctx, String name, String password) {
public void testCleartextStorageAndroiDatabase0(Context ctx, String name, String password) {
SQLiteDatabase db = ctx.openOrCreateDatabase("test", Context.MODE_PRIVATE, null);
String query = "INSERT INTO users VALUES ('" + name + "', '" + password + "');";
db.execSQL(query); // $ hasCleartextStorageAndroidDatabase
}
public void testCleartextStorageAndroiDatabase1(Context ctx, String name, String password) {
SQLiteDatabase db = SQLiteDatabase.openDatabase("", null, 0);
String query = "INSERT INTO users VALUES ('" + name + "', '" + password + "');";
db.execSQL(query); // $ hasCleartextStorageAndroidDatabase
}
public void testCleartextStorageAndroiDatabase2(String name, String password) {
SQLiteDatabase db = SQLiteDatabase.create(null);
SQLiteDatabase db = SQLiteDatabase.openOrCreateDatabase("", null);
String query = "INSERT INTO users VALUES (?, ?)";
db.execSQL(query, new String[] {name, password}); // $ hasCleartextStorageAndroidDatabase
}